Event details

Have questions about how device manufacturers support the Secure Boot certificate update process? Join OEM Secure Boot Office Hours to connect directly with OEMs and get answers to your questions. Th...
Heather_Poulsen
Updated Jul 15, 2026
Office Hours
Swartz99's avatar
Swartz99
Tin Contributor
Jul 15, 2026

Any OEM, is there going to be a date where a device that still has 2011 certs will never be able to update to the 2023 certs? 

  • Dan_Pandre's avatar
    Dan_Pandre
    Icon for Microsoft rankMicrosoft
    Jul 15, 2026

    Answer for Surface: Every model which is currently eligible for an update will still be eligible for it later, and Windows Update is the easiest way to get these KEK updates. A more involved process is also documented at https://support.microsoft.com/en-US/surface/drivers-firmware/surface-secure-boot-certificates

    Surface models that originally launched with Windows 8 are not eligible. This means Surface Pro 3, Surface 3, and older devices.

    Surface models that launched in 2024 or later do not need these updates and shipped with the 2023 certificates already present.

  • Juergen_Bayer's avatar
    Juergen_Bayer
    Tin Contributor
    Jul 15, 2026

    HP's answer: On HP commercial platforms from 2019 and newer, the latest BIOS version includes updated Secure Boot UEFI variables for the default databases, with the 2023 certificates added. After installing this BIOS version, the active Secure Boot databases can be reinitialized to include the 2023 certificates. As a result, these devices will always be capable of having the Secure Boot 2023 certificates present in the Secure Boot active databases.